[dependabot]

Bumps Factory-AI/droid-action from 7 to 10.

Release notes

Sourced from Factory-AI/droid-action's releases.

v10

What's Changed

Security fix: long GitHub App tokens are fully redacted

• ghs_ installation tokens in GitHub's new long format are now fully redacted in action output (#160)
  • The old pattern only matched 36-character alphanumeric tokens. A ~520-character token was left unredacted, or only its first 40 characters were masked if it contained . or -
  • Redaction now uses GitHub's recommended pattern, ghs_[A-Za-z0-9._-]{36,}. Other token types are unchanged

Deep preset runs at medium reasoning effort

• review_depth: deep now uses medium reasoning effort instead of high (#149)
  • The model is unchanged (openai-latest-balanced). medium is the model's default effort and uses fewer output tokens per review
  • This applies to every workflow that doesn't set reasoning_effort: code review candidates, the validator, dedicated security reviews, and GitLab reviews. Subagents spawned during a review inherit it
  • To keep the previous behavior, set reasoning_effort: high

Review session tag records security review

• The code-review session tag now carries securityReview: "true" | "false" on both passes of a code review, on GitHub and GitLab (#149)
  • This lets analytics split code review and security review spend without parsing prompt text. Dedicated security reviews (reviewType: "security") omit it

Docs

• The GitHub auto-review example sets allowed_bots: factory-droid, so runs triggered by Factory Droid are allowed. The action-wide default is unchanged (#152)
• The README now explains that security review reads .factory/skills/security-review-guidelines/SKILL.md, not review-guidelines (#159)

Full Changelog: Factory-AI/droid-action@v9...v10

v9

What's Changed

Review presets follow Factory's recommended models

• review_depth presets now use model tier aliases instead of pinned model IDs, so reviews move to newer models automatically without a new action release (#144)
  • Leaving review_model empty (recommended) uses Factory's recommended review model with high reasoning, currently GPT-6 Sol
  • review_model accepts tier aliases such as openai-latest-premium or anthropic-latest-balanced to pick a provider while still upgrading automatically; all 9 aliases are listed in the README under "Advanced: model overrides"
  • Specific model IDs still work in review_model / security_model, but pin the review to that model
  • The CLI enforces org model policy on the model an alias resolves to, and skips candidates the policy blocks
• README, GitLab guide, workflow template, and input descriptions now steer to review_depth and move model overrides to an advanced section (#144)

Works on older Droid CLIs

• If the installed CLI predates tier aliases, the action uses the equivalent concrete model with no note or error (#147)
  • GitHub: an Invalid model rejection of an alias reruns immediately with the stand-in, in the same attempt
  • GitLab: prepare probes the alias before the review passes and swaps in the stand-in before the org policy pre-flight; the probe runs without GitLab tokens
• Model blocked by organization policy from the CLI now triggers the existing fallback to the org's default model, and fallback notes name the model the workflow requested (#144, #147)

Full Changelog: Factory-AI/droid-action@v8...v9

v8

What's Changed

Review sessions carry a structured tag

• Every review pass now sends --tag with metadata instead of a bare code-review name (#142)
  • {name:"code-review", metadata:{pass, reviewType, platform, repo, pr, runId, runAttempt}} on GitHub and GitLab, for both the candidates and validator passes
  • The tag name is unchanged, so existing code-review filters keep working; the metadata lets analytics identify and pair review sessions without parsing prompt text (GitLab MR !N and dotted repo names were previously misclassified)

... (truncated)

Commits

• ec767fc Merge pull request #163 from Factory-AI/dev
• 1b45850 Merge pull request #160 from Factory-AI/droid/ghs-token-long-format
• 55ebb1e fix: fully redact long GitHub App installation tokens
• 4402f1e Merge pull request #159 from Factory-AI/nizar/security-guidelines-readme
• 4504933 docs: correct which guidelines skill security review reads
• 64a0d1d Merge pull request #149 from Factory-AI/nizar/security-subagent-tag
• 8f0b135 Merge pull request #152 from Factory-AI/nizar/review-bot-readme
• 057f460 docs: clarify review actor and format example
• e8de949 Update README.md
• 9bcde01 refactor(review): rename the session tag's security flag to securityReview
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)